Signature Base unknown stable yara

MAL_3CXDesktopApp_MacOS_Backdoor_Mar23 [yara]

Detects 3CXDesktopApp MacOS Backdoor component

View Source

Detection Logic

( ( uint16(0) == 0xfeca or uint16(0) == 0xfacf or uint32(0) == 0xbebafeca ) and filesize < 6MB
         and
         (
            ( 1 of ($sa*) and 1 of ($op* ) )
            or all of ($sa*)
         )
      )
      or ( all of ($op*) )

Field Validations

Loading…

Comments (0)

Loading comments...